CVE-2026-53517

Katalog CVE

CVSS 8.1 · High EPSS 0,42%

Kerentanan Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') pada better-auth/oauth-provider, better-auth better auth. Skor CVSS 3.1 8.1 (High) menurut github.com.

Deskripsi (NVD)

Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint on the refresh_token grant performs a non-atomic read, validate, revoke, and mint sequence on the oauthRefreshToken row, allowing concurrent requests with the same parent refresh token to pass the revoked check and create forked refresh-token families; the vulnerable range also includes embedded better-auth plugin versions before 1.6.0. This issue is fixed in version 1.6.11.

Rincian

Terbit di NVD

15 Juli 2026

Terakhir diubah

21 Juli 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/better-auth/better-auth/security/advisories/GHSA-392p-2q2v-4372 mitigasi · advisory vendor
• https://github.com/better-auth/better-auth/commit/c6918ecc9e3a75892169415d7f6c95b591b6a52d patch
• https://github.com/better-auth/better-auth/releases/tag/v1.6.11 release notes